emotet | af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e

Analysis

max time kernel
299s
max time network
302s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16-03-2023 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

click.wsf
Size

61KB
MD5

45282862aeb428ffb5d4986704a8f4d5
SHA1

fa2b0a82f3ca6bc7c00704556c9494b303613972
SHA256

af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e
SHA512

db6457af502f45665ce4cc6573c5746607d8ffc661f0dcb224beceed93886f6c6194561cacc0efa543f0b2f62db976742f42c6c8102c5b11b65329757110b1db
SSDEEP

768:6hKs7p4MAPEQbhh/8avllsFEaN3K19Z5zkzCIi5:6L7p4MafVLYEaN3K19ZWzCn5

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

103.85.95.4:8080

103.224.241.74:8080

178.238.225.252:8080

37.59.103.148:8080

78.47.204.80:443

138.197.14.67:8080

128.199.242.164:8080

54.37.228.122:443

37.44.244.177:8080

139.59.80.108:8080

218.38.121.17:443

82.98.180.154:7080

114.79.130.68:443

159.65.135.222:7080

174.138.33.49:7080

195.77.239.39:8080

193.194.92.175:443

198.199.70.22:8080

85.214.67.203:8080

93.84.115.205:7080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

2 2044 WScript.exe
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

904 regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

904 regsvr32.exe
672 regsvr32.exe
672 regsvr32.exe

flow	pid	process
2	2044	WScript.exe

pid	process
904	regsvr32.exe

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
904	regsvr32.exe
672	regsvr32.exe
672	regsvr32.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

WScript.exeregsvr32.exe

description	pid	process	target process
PID 2044 wrote to memory of 904	2044	WScript.exe	regsvr32.exe
PID 2044 wrote to memory of 904	2044	WScript.exe	regsvr32.exe
PID 2044 wrote to memory of 904	2044	WScript.exe	regsvr32.exe
PID 2044 wrote to memory of 904	2044	WScript.exe	regsvr32.exe
PID 2044 wrote to memory of 904	2044	WScript.exe	regsvr32.exe
PID 904 wrote to memory of 672	904	regsvr32.exe	regsvr32.exe
PID 904 wrote to memory of 672	904	regsvr32.exe	regsvr32.exe
PID 904 wrote to memory of 672	904	regsvr32.exe	regsvr32.exe
PID 904 wrote to memory of 672	904	regsvr32.exe	regsvr32.exe
PID 904 wrote to memory of 672	904	regsvr32.exe	regsvr32.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\click.wsf"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" "C:\Users\Admin\AppData\Local\Temp\rad09DC4.tmp.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MibJikIatKNVsAqS\nOwksIQ.dll"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:672

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rad09DC4.tmp.dll
Filesize
300KB

MD5
27c6e6bc4b46148fb4dcc6a6a9346914

SHA1
065d7e71a66ef077b07ea28d7e26b07ea5a26c86

SHA256
aa57889a91be96c5b5cae185792f5ad76eb5248abb66344a740266a1c297cfd7

SHA512
3b50da2b20c50c07d9ad916623ee9da5455f2724567a171943959226dee18bc359de10f0638a34b50c51ba7e539f4845167f52b9f083966dd8a3f3a3454bba26

Download Submit
\Users\Admin\AppData\Local\Temp\rad09DC4.tmp.dll
Filesize
300KB

MD5
27c6e6bc4b46148fb4dcc6a6a9346914

SHA1
065d7e71a66ef077b07ea28d7e26b07ea5a26c86

SHA256
aa57889a91be96c5b5cae185792f5ad76eb5248abb66344a740266a1c297cfd7

SHA512
3b50da2b20c50c07d9ad916623ee9da5455f2724567a171943959226dee18bc359de10f0638a34b50c51ba7e539f4845167f52b9f083966dd8a3f3a3454bba26

Download Submit
memory/904-57-0x00000000004F0000-0x000000000051C000-memory.dmp

Filesize
176KB

Download
memory/904-60-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download